NSAuditor AI EE 0.32.6: Network-Scan False-Negative Closures — Cleartext Transport, SMB-Alone, WinRM, Elasticsearch 9300, MSRPC 135, and Aggregate Exposure
NSAuditor AI EE 0.32.6 closes a cluster of network-scan detections that used to return a clean verdict over a real exposure — cleartext transport, SMB-without-RDP, WinRM, Elasticsearch 9300, MSRPC 135, and aggregate over-exposure — all routed to SOC 2. Matrix-neutral: no new framework, no new plugin, no coverage number moves.
A security scanner’s worst failure is a clean verdict over a real exposure. NSAuditor AI 0.32.6, released July 19, 2026, closes a cluster of those on the network-scan path — detections the tool should always have had. It is a matrix-neutral release: no new framework, no new plugin, no coverage number moves, just detection that was missing.
These closures live on the analysis-agent (network-scan) path, not the cloud-scan path — a distinction the release notes are careful to preserve.
A service with no encryption at all used to read clean
The crypto analysis agent evaluated the quality of transport encryption — weak protocol versions, weak ciphers, expired or self-signed certificates. But every one of those checks was gated on a TLS handshake already existing. A service that should have been encrypted and offered no TLS at all matched none of them and fell through to a clean result. The perverse consequence: a merely-weak cipher reported dirty, while plaintext reported clean — the check was gated on the very condition whose absence is the violation.
0.32.6 adds a distinct “no transport encryption” path: a should-be-encrypted service that negotiates no TLS is now a finding, routed to SOC 2 CC6.7. Adversarial review sharpened it before it shipped — a STARTTLS server that offers encryption on upgrade is not false-failed, an unfingerprinted service falls back to a port-based judgment instead of being miscalled, and a self-caught false positive on HTTPS-over-8080 was fixed in the same pass.
SMB-without-RDP — the higher-risk case the rule was built to miss
The lateral-movement rule required SMB AND RDP both be exposed. That silenced precisely the more dangerous case: SMB (445/139) open without RDP. EternalBlue-class initial access does not need RDP, so the conjunction muted the exact exposure a defender most wants flagged. SMB-alone is now its own HIGH finding; SMB plus RDP remains an escalation on top. MSRPC (135) is brought into scope too — and, deliberately, the 135-only case is not branded “EternalBlue,” a precision correction made during review.
Four exposures that had no detector at all
WinRM (5985/5986), Elasticsearch’s transport port (9300 — the query port 9200 was already covered), MSRPC (135), and an aggregate open-port count for an over-exposed host with no single “known” high-risk port were structurally invisible before this release. Each now produces an exposure finding, routed to SOC 2 CC6.6. Both analysis agents were also brought under an emission-drift detector, so a future wording change fails the build rather than silently un-routing a finding.
Routed SOC 2-first — and honest about what that does and does not mean
The new detections route to already-covered SOC 2 controls — CC6.6 for network exposure and CC6.7 for transit encryption. The release states the scope precisely: this cycle adds SOC 2 routing, not cross-framework coverage. The same exposures map naturally to HIPAA §164.312(e)(1), CIS Safeguards 4.4 / 3.10 / 4.6, and NIST CSF PR.* — but those mappings are deferred to a follow-up and are not claimed here. Adding a detection is not the same as wiring it into all seven frameworks.
The release is matrix-neutral: 28 plugins unchanged, and all seven coverage matrices identical to the prior version (SOC 2 10/4/33, HIPAA 7/3/45, NIST CSF 13/10/83, PCI DSS 19/9/39, ISO 27001 17/14/62, CIS Controls v8 17/23/113, GDPR Art. 32 4/5/2).
Where it is validated
Because these detections live on the network-scan path, a cloud-scan prompt does not exercise them. The release is validated by the unit suite — 9012 pass / 0 fail, up 24 tests, with detect-and-route proven end-to-end and isolated so a test cannot pass for the wrong reason — plus a live network scan against a host with the relevant ports open.
Versions
Enterprise @nsasoft/nsauditor-ai-ee@0.32.6 (restricted), Community Edition nsauditor-ai@0.2.31 (MIT, no code change this cycle — a paired bump), and the paired agent skill nsauditor-ai-agent-skill@0.2.29. The Community Edition is free and MIT-licensed, and every scan runs entirely on the user’s own infrastructure with zero data exfiltration. More at nsauditor.com/ai/enterprise.
